CVE-2026-71556: 
Packer 脆弱性の分析と軽減

CVE-2026-71556 is a symlink traversal vulnerability in go-git, an extensible Git implementation library written in pure Go, that allows worktree operations (checkout, status, add) to follow symbolic links outside the intended working directory boundary. The vulnerability affects go-git versions prior to 5.19.2 and 6.0.0-alpha.1 through 6.0.0-alpha.4. It was published on July 30, 2026 (advisory date) and disclosed publicly on August 7, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is CWE-59 (Improper Link Resolution Before File Access / 'Link Following'): the worktreeFilesystem wrapper validated path strings for dangerous patterns (e.g., .git, .., control characters) but did not check whether existing symbolic links on disk could cause those paths to resolve outside the worktree boundary. Two exploitation scenarios exist: (1) a symlink at a leading directory component (e.g., s → .git) causes writes like s/config to land in .git/config; (2) a symlink at the final path component (e.g., s → .git/config) causes an OpenFile with O_TRUNC to overwrite the target. The fix introduces validNoLeadingSymlink and validWritePath functions that inspect on-disk state via Lstat before every mutating or read operation, and clearBlockingSymlinks removes blocking symlinks before checkout materialisation (GitHub Advisory, Patch Commit v5, Patch Commit v6).

Successful exploitation allows an attacker to write to or read from files outside the intended worktree directory, including the repository's .git metadata directory. The most critical impact is high integrity loss: an attacker can overwrite .git/config or other Git metadata, potentially enabling repository configuration tampering, hook injection, or credential theft. Availability is also mildly impacted (CVSS availability: Low), while confidentiality is not directly affected. Applications using in-memory storage (storage/memory or go-billy/memfs) are not vulnerable (GitHub Advisory).

Exploitation requires user interaction — specifically, a user must clone a maliciously crafted repository and perform worktree operations against it. No privileges are required on the attacker's side. As of the disclosure date, there is no evidence of in-the-wild exploitation; NVD SSVC assessment lists exploitation as "none" (Feedly). The EPSS score is approximately 0.0029 (0.29%), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. No public PoC exploit code has been identified.

1. Craft a malicious repository: Create a Git repository containing a tracked symlink entry — for example, a symlink named s pointing to .git (a leading-component attack) or a symlink named s pointing directly to .git/config (a final-component attack).
2. Distribute the repository: Host the malicious repository on a publicly accessible Git server or share it via other means to lure a target into cloning it.
3. Victim clones the repository: The target user clones the repository using an application built on go-git (versions < 5.19.2 or 6.0.0-alpha.1 to 6.0.0-alpha.4), which materialises the symlink into the worktree.
4. Trigger a worktree operation: Any subsequent worktree operation (checkout, status, add) that accesses a path through the planted symlink causes go-git to follow the link outside the worktree boundary.
5. Achieve out-of-boundary write: For example, if s → .git, a write to s/config overwrites .git/config, allowing the attacker to inject malicious Git hooks or alter remote URLs for credential harvesting (GitHub Advisory).

• File System: Unexpected symbolic links in the worktree directory pointing to .git or its subdirectories (e.g., ls -la revealing s -> .git or s -> .git/config); unexpected modifications to .git/config (check git config --list for unfamiliar remote URLs or hook configurations); presence of unexpected files in .git/hooks/ with executable permissions.
• Logs: Application logs from go-git-based tools showing worktree operations on paths containing symlinks; unexpected file modification timestamps on .git/config or other metadata files coinciding with a clone or checkout event.
• Process: Unexpected execution of scripts from .git/hooks/ (e.g., pre-commit, post-checkout) shortly after a repository clone or checkout operation.

Users should upgrade to go-git v5.19.2 (for the v5 branch) or v6.0.0-alpha.5 (for the v6 alpha branch), which make the worktreeFilesystem wrapper a symlink-safe boundary by rejecting paths that traverse existing symlinks (v5.19.2 Release, v6.0.0-alpha.5 Release). No configuration-based workaround is available; the only mitigation is upgrading. Applications using storage/memory or go-billy/memfs are not affected and do not require action (GitHub Advisory).

The vulnerability was reported by two independent researchers, @kodareef5 and @HughLewis20, who worked with the go-git security team toward resolution. The advisory was published by maintainer @pjbgf and credited both reporters. The fix was also noted to mirror upstream Git's own symlink safety mechanisms (has_symlink_leading_path in symlinks.c). No significant broader media coverage or social media discussion has been identified beyond standard vulnerability database aggregation (GitHub Advisory).